mise.toml

[tools]
shellcheck = "0.11.0"
hadolint = "2.15.1"
yq = "4.53.6"
deno = "2.9.5"
cosign = "3.1.3"
s5cmd = "2.3.0"
hugo = "0.165.0"
imagemagick = "7.1.2_30"

[settings]
env_file = ".env"

[tasks."build"]
run = [
    { task = "build:image" },
    { task = "build:chunked-image" },
    { task = "build:iso" },
]

[env]
_.file = ["{{ get_env(name='COMPUTERNAME', default=get_env(name='HOSTNAME', default='ANY')) }}.env", ".env"]

# Fedora major version of the base image (Kinoite).
FEDORA_MAJOR_VERSION="44"

# Base image (Fedora Atomic Desktop, KDE = Kinoite).
BASE_IMAGE="quay.io/fedora-ostree-desktops/kinoite"

# -----------------------------------------------------------------------------
# Target registry / image name
# -----------------------------------------------------------------------------
# Primary registry: GitHub Container Registry (ghcr.io). Public projects have
# no pull/storage limits there.
# These may be overridden from the environment (e.g. to push to a different
# registry in CI or a local test registry): a preset value wins over the
# default below.
IMAGE_REGISTRY="ghcr.io"
IMAGE_NAME="echocat/bluecat"

# Local build tags. `mise build:image` builds :local, then `mise build:chunked-image`
# creates output/bluecat.oci with the :local-chunked reference. Publishing copies
# that OCI layout to the real tags:
#   release       -> <major>.<UTC-timestamp>, <major>   (all pushed)
#   pr <number>   -> pr-<number>                        (only this)
LOCAL_IMAGE_TAG="local"
LOCAL_CHUNKED_IMAGE_TAG="local-chunked"

# -----------------------------------------------------------------------------
# Secure Boot / MOK signing
# -----------------------------------------------------------------------------
# Names of the certificate files (inside the certs/ directory).
# IMPORTANT: The private key (MOK_KEY) must NEVER be committed.
#            Only the public part (MOK_CERT_DER / MOK_CERT_CRT) is safe and
#            gets placed into the image.
MOK_KEY="certs/mok.key"      # PRIVATE - blocked by .gitignore!
MOK_CERT_DER="certs/mok.der" # PUBLIC (DER, for mokutil / kernel)
MOK_CERT_CRT="certs/mok.crt" # PUBLIC (PEM, used for signing)

# Subject for the self-signed certificate.
MOK_SUBJECT="/CN=echocat Secure Boot Signing/"

# -----------------------------------------------------------------------------
# Offline install ISO (mise build:iso)
# -----------------------------------------------------------------------------
# The ISO is a Fedora boot medium with an embedded Kickstart and an embedded
# chunked bluecat OCI payload. The initial install is offline; the installed
# system records ISO_IMAGE_TAG as its update target.
#
# ISO_IMAGE_TAG : which tag the installer pulls. Defaults to the Fedora major
#                 version stream (e.g. "44"). The image MUST be pushed under
#                 this tag before the ISO is usable.
# ISO_BASE_URL  : the upstream Fedora netinst boot ISO used as the base for
#                 mkksiso. Kept as a variable so it can be bumped per release.
# ISO_BUILDER_IMAGE : Fedora container image that provides `mkksiso` (lorax);
#                 mkksiso does not run on non-Fedora hosts, so it runs in here.
ISO_IMAGE_TAG="{{ env.FEDORA_MAJOR_VERSION }}"
ISO_BASE_URL="https://download.fedoraproject.org/pub/fedora/linux/releases/{{ env.FEDORA_MAJOR_VERSION }}/Everything/x86_64/os/images/boot.iso"
ISO_BUILDER_IMAGE="registry.fedoraproject.org/fedora:{{ env.FEDORA_MAJOR_VERSION }}"

# Environment variables required for uploading release assets.
ISO_S3_ENDPOINT_URL = "https://76cbc9ff3d45b6d0e9963e41ddeb9b71.eu.r2.cloudflarestorage.com"
ISO_S3_BUCKET = "bluecat"
ISO_S3_PREFIX = "latest"
ISO_PUBLIC_BASE_URL = "https://download.bluecat.echocat.org"